Home / Security

Security

Vulnerability Disclosure Policy

Last updated: October 2026.

BugRater exists so researchers can see how programs really treat them. We hold ourselves to the standard we hold them to: if you find a vulnerability in BugRater, we want to hear about it, we'll keep you in the loop, and we won't come after you for looking.

What's in scope

Anything BugRater runs, including:

• bugrater.com and every page and form on it.
• Accounts and sign-in: registration, passwords, email verification, password reset, Discord sign-in, device sign-in, and sessions.
• Our APIs, and "Sign in with BugRater" for other apps.
• End-to-end encryption: your keys, encrypted disclosures, and collabs. Anything that lets us or anyone else read what should stay sealed.
• BugBadge credentials and their verification and signing.
• The company portal, claimed profiles, and the disclosure inbox, including anything that would let one company see another's reports.
• Reviews, moderation, and ratings, including ways to post as someone else, skip moderation, or move a program's grade.

What's out of scope

Please don't report:

• Vulnerabilities in the programs and companies listed on BugRater. Report those to them, as above.
• Services we use but don't run, such as our hosting provider, Discord, or our email provider. Report those to their owners, though do tell us if our setup of them is the problem.
• Denial of service, load testing, or anything that relies on flooding us with traffic.
• Social engineering or phishing of our staff or users, and physical attacks.
• Scanner output without a demonstrated impact.
• Missing headers, cookie flags, or email records (SPF, DKIM, DMARC) without a working attack that uses them.
• Clickjacking on pages with no sensitive action, logout CSRF, and self-XSS.
• Software version banners, and bugs that only work in unsupported or out-of-date browsers.

How to test

To stay within this policy:

• Only use accounts you own or test accounts you've created. Two of your own accounts are enough to show one user reaching another's data.
• Don't look at, change, or delete other people's data. If you come across any, stop, don't keep a copy, and tell us what you saw.
• Keep automated testing slow enough that the site stays fast for everyone else.
• Don't publish test content that names real programs, companies, or people. Start test submissions with "VDP test" so moderators can spot them.
• Don't pivot from a finding into further systems or keep access longer than you need to show the issue.
• Keep the details private until it's fixed or we've agreed a date with you (see Disclosure below).

How to report

Email hello@bugrater.com. A good report includes:

• What the vulnerability is and what an attacker could do with it.
• Steps to reproduce it, with the URLs, parameters, and accounts involved.
• A proof of concept, screenshots, or a short video if they help.
• The name or handle you'd like credit under, if any.

If the details are too sensitive for plain email, say so in a short first message and we'll set up a secure channel with you. One issue per report helps us fix things faster, but a chain of bugs belongs in one report.

What happens next

• Within 2 business days: a person replies to confirm we have your report.
• Within 7 days: we tell you whether we can reproduce it, how severe we think it is, and why.
• While we fix it: you hear from us at least every 14 days, even if the news is "still working on it".
• Fix targets: critical within 7 days, high within 30, medium and low within 90.
• When it's fixed: we tell you, ask you to check the fix if you'd like to, and credit you if you want to be credited.

If we decide something isn't a vulnerability, or rate it lower than you do, we'll explain our reasoning, and we're open to being shown we're wrong.

Safe harbor

If you make a good-faith effort to follow this policy, we consider your research to be:

• Authorized under anti-hacking laws. We won't start or support legal action against you for it, including for accidental, good-faith slips outside this policy.
• Authorized under anti-circumvention laws. We won't bring a claim against you for getting around technical controls to test them.
• Exempt from the parts of our terms of service that would stop you doing security research. We waive those restrictions for research within this policy.
• Lawful, helpful, and done in good faith. We won't refer you to law enforcement for it.

If someone else brings legal action against you over research done within this policy, we'll make it known that your research was authorized.

You're still expected to follow the law. If you're not sure whether something you want to try is within this policy, ask us first at hello@bugrater.com.

Disclosure

We'll agree a disclosure date with you. By default that's once the fix is live, or 90 days after your report, whichever comes first. If a fix needs longer we'll explain why and ask; if it's being exploited, we may both need to move faster. We don't ask for NDAs, and once it's fixed you're free to write about what you found.

For anything that affected users' data or accounts, we'll publish our own account of what happened and what we changed in our change notes.

Thanks

We don't pay bounties for BugRater yet. What we can offer is honest credit: with your permission we list you here and in the change notes for the fix, and we're glad to confirm your finding to anyone who asks.

No one yet. Yours could be the first report on this list.

Questions about this policy go to hello@bugrater.com too. Tools can find these details in our security.txt.